summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix the horrible and undocumented behaviour of X509_check_trustbeck2024-07-124-54/+73
| | | | | | | | | | | | | | | | | | | | Of allowing you to pass in a NID directly, instead of a trust_id, and have it work, as long as the trust_id's and the NID's did not overlap. This screwball behaviour was depended upon by the OCSP code that called X509_check_trust with the NID, instead of the trust id, so let's fix that. We also rename the confusingly named X509_TRUST_DEFAULT to X509_TRUST_ACCEPT_ALL which makes a lot more sense, and rototill this to remove the confusingly named static functions. This will shortly be follwed up by making this function private, so we have not bothered to fix the amazingly obtuse man page as it will be taken behind the barn at that time. ok tb@
* Clean up in X509_check_trust.beck2024-07-121-14/+8
| | | | | | | | | | | | | | | The XXX comment in here is now outdated. Our behaviour matches boringssl in that passing in a 0 trust gets the default behavior, which is to trust the certificate only if it has EKU any, or is self signed. Remove the goofy unused nid argument to "trust_compat" and rename it to what it really does, instead of some bizzare abstraction to something simple so the code need not change if we ever change our mind on what "compat" is for X.509, which will probably only happen when we are back to identifying things by something more sensible like recognizable grunts and smells. ok jsing@
* Drop the unused evp includetb2024-07-121-2/+1
|
* Rename the sk in this file to extstb2024-07-121-16/+16
|
* Avoid using ret for an X509_EXTENSIONtb2024-07-121-16/+16
| | | | | | | Instead rename the **ext in this file to **out_ext, freeing up ext in X509_EXTENSION_create_by_OBJ() Appeases some jsing grumbling on review
* Tweak variable names in X509v3_add_ext()tb2024-07-121-12/+12
| | | | | | x -> out_ext, sk -> exts requested by jsing on review
* Rename crit to critical in this filetb2024-07-121-10/+10
| | | | requested by jsing on review
* Simplify X509_EXTENSION_get_critical()tb2024-07-121-4/+3
| | | | | | This is a silly API, but there are worse. ok jsing
* Lose a few extra lines in X509_EXTENSION_set_object()tb2024-07-121-4/+2
| | | | ok jsing
* Streamline X509_EXTENSION_create_by_OBJ()tb2024-07-121-9/+10
| | | | ok jsing
* Clean up X509_EXTENSION_create_by_NID()tb2024-07-121-9/+5
| | | | | | | | Remove unnecessary ret parameter and freeing of obj (which looks like a double free or freeing of unallocated memory but actually isn't due to various magic flags). Also make this const correct. ok jsing
* Rewrite X509v3_add_ext()tb2024-07-121-24/+23
| | | | | | | | | | | | | This is another brilliancy straight out of muppet labs. Overeager and misguided sprinkling of NULL checks, going through the trademark poor code review, made this have semantics not matching what almost every other function with this signature would be doing in OpenSSL land. This is a long standing mistake we can't fix without introducing portability traps, but at least annotate it. Simplify the elaborate dance steps and make this resemble actual code. ok jsing
* Simplify X509v3_get_ext() and X509v3_delete_ext()tb2024-07-121-7/+1
| | | | | | Drop unnecessary checks that are part of the stack API. ok jsing
* Align X509v3_get_ext_by_critical() with X509v3_get_ext_by_OBJ()tb2024-07-121-12/+9
| | | | | | Plus, replace a manual check with a call to X509_EXTENSION_get_critical(). ok jsing
* Clean up X509v3_get_ext_by_OBJ()tb2024-07-121-11/+7
| | | | | | | | Like most of its siblings, this function can be simplified significantly by making proper use of the API that is being built. Drop unnecessary NULL checks and other weirdness and add some const correctness. ok jsing
* Despite being an ELF citizen, hppa is its own special snowflake and requiresmiod2024-07-111-1/+5
| | | | | | | different asm stanzas to produce strong aliases. This unbreaks libcrypto (and thus ssh, among other things) on hppa after the recent switch to LIBRESSL_CRYPTO_NAMESPACE.
* Remove the static symbols.namespace, and just generate the _libre_beck2024-07-102-3359/+3
| | | | | | symbols from symbols.list now that we have everything hidden ok tb@
* forgot to add a history section for the TLS PRF APItb2024-07-101-1/+4
|
* link EVP_PKEY_CTX_set_tls1_prf_md.3 to buildtb2024-07-101-1/+2
|
* Import EVP_PKEY_CTX_set_tls1_prf_md.3 from OpenSSL 1.1.1tb2024-07-101-0/+168
| | | | | With only slight application of color to this entelodont's lips. It's the usual deal - hard to say what's worse, the code or its docs...
* Including kdf.h isn't enough, you also need evp.htb2024-07-101-2/+3
| | | | | It will be a cold day in hell before I see an OpenSSL manpage without mistakes in it.
* Unwrap two linestb2024-07-101-7/+4
|
* Add another empty linetb2024-07-091-1/+2
|
* Turn tls1_prf_alg() into single exittb2024-07-091-9/+11
| | | | | requested by jsing on review ok beck
* Unwrap a few more linestb2024-07-091-9/+5
|
* Unwrap a couple of linestb2024-07-091-5/+3
|
* Align math with t1_enc.ctb2024-07-091-6/+8
| | | | suggested by jsing on review
* Minor cosmetics in pkey_tls1_prf_derive()tb2024-07-091-5/+3
| | | | noticed by jsing on review
* Replace explicit_bzero() plus free() with freezero()tb2024-07-091-3/+2
| | | | This is simpler, if slightly more expensive
* Shuffle things into a more sensible ordertb2024-07-091-63/+58
| | | | no functional change
* Use better order in EVP_PKEY_CTRL_TLS_SECRETtb2024-07-091-6/+5
| | | | Also avoid an unnecessary NULL check.
* Add tls1_prf_pkey_meth to pkey_methodstb2024-07-091-1/+3
| | | | ok jsing
* Make a NULL check explicittb2024-07-091-2/+2
|
* Zap or align some ugly commentstb2024-07-091-4/+3
|
* Test & assign once moretb2024-07-091-4/+4
|
* sec_len -> secret_lentb2024-07-091-3/+3
|
* Test and assign in tls1_prf_P_hash()tb2024-07-091-5/+8
|
* Fix whitespace around '/'tb2024-07-091-4/+4
|
* Invert logic in tls1_prf_alg()tb2024-07-091-22/+22
|
* olen -> out_lentb2024-07-091-15/+15
|
* Add a few empty linestb2024-07-091-1/+7
|
* seedlen -> seed_lentb2024-07-091-10/+10
|
* seclen -> secret_lentb2024-07-091-7/+7
|
* slen -> secret_lentb2024-07-091-7/+8
|
* sec -> secrettb2024-07-091-17/+17
|
* Replace local typedef with spelling out the struct nametb2024-07-091-8/+8
|
* Remove a few useless commentstb2024-07-091-6/+1
|
* Apply a knfmt(8) sledgehammertb2024-07-091-226/+236
|
* Add an RCS tagtb2024-07-091-1/+1
|
* Replace license stub with full licensetb2024-07-091-5/+55
| | | | | This reverts to the license added in OpenSSL's initial import of this file in commit 1eff3485b63f84956b5f212aa4d853783bf6c8b5
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-03 02:35:08 +0000